Trimming the URI Path from end

[satish_kumar1 (Satish Kumar)]

Hi All,

I am new to logstash, I am working on creating visualization of top API based on AWS ELB logs, and i am stucked at this point where i need to trim URIPath.

example request: https://www.google.com/test/v1/api/006b2511-b009-11e8-b30f-0165a332b61d

Actual URIPATH: "/test/v1/api/006b2511-b009-11e8-b30f-0165a332b61d"

I am looking for parsing logic so that after parsing URI path should come like this.

URIPATH: "/test/v1/api"

I have given example for one scenairo, but we have multiple api's and last section of URIPATH is different in length.

For example:

https://www.test.com/testing/v3/mgmt/18-EE-69-9FF4049E7C723EE724491E1D8141096B1C7374FC0EBA1421AE4D72F71F96D3AC

Please guide me how to trim URIPATH from end upto '/'

Regards,
Satish

[magnusbaeck (Magnus Bäck)]

You can e.g. use a mutate filter's gsub option to replace the protocol and hostname (and optionally port) with an empty string. A regexp like ^https?://[^/]+ would do.

[satish_kumar1 (Satish Kumar)]

thanks magnus, i will try this out and check if it works for my scenario